Lockbit3 ransomware group lists truehomes.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Professional Services
• Announcement date: April 5, 2024

Lockbit3 claims data breach against truehomes.com

The Lockbit3 ransomware group has listed truehomes.com on its dedicated leak site, claiming that the organization has been the victim of a data breach. This announcement, made on April 5, 2024, follows a period of alleged unauthorized access that the threat actor group claims occurred on March 15, 2024. While the group has posted the organization's name on its portal, the specific details regarding the nature of the incident and the content of the files remain limited to the group's claims.

Ransomware leak sites serve as a platform for threat actors to exert pressure on their victims through a method often referred to as double extortion. In such scenarios, attackers do not merely encrypt an organization's local systems to disrupt operations; they also exfiltrate sensitive information. The threat of releasing this stolen data publicly is used as leverage to coerce the victim into paying a ransom. By listing a company on these sites, the attackers aim to damage the victim's reputation and create public pressure to ensure payment.

Details of the alleged incident

According to the information provided by the Lockbit3 group, the listing of truehomes.com was accompanied by a countdown timer. The group indicated that the data allegedly belonging to the organization would be released to the public once this timer reached zero. The current listing includes general promotional text regarding the operations of the organization, but it does not provide specific technical details regarding how the breach was executed or the exact timing of the data exfiltration.

Regarding the specific content of the breach, the listing names no data types. There is no specific information regarding the nature of the allegedly leaked data in the listing or the provided records, and no information was provided concerning the total size of the data or the specific file count involved in the incident.

About truehomes.com

True Homes is a residential home builder operating in the North and South Carolina regions of the United States. The company provides customizable new home construction projects and real estate development services. As a provider in the professional services sector, the organization manages various aspects of residential development and construction projects within its specific geographic regions.

Threat actor profile and potential implications

The Lockbit group is a known threat actor operating under a Ransomware-as-a-Service (RaaS) model. This model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks, making the group's operations highly scalable. Despite international law enforcement operations targeting the group's infrastructure in February 2024, the group has been observed to be active again.

The potential leakage of an organization's data can lead to significant secondary risks. For a company involved in real estate and construction, such risks include identity theft or targeted phishing attacks directed at customers and employees. Furthermore, because the organization is based in the United States, a potential data breach could lead to legal proceedings under state-level privacy laws and sectoral regulations.

The publication of data by groups like Lockbit3 can result in substantial reputational damage and operational disruptions for the organization. To mitigate such risks, organizations in the professional services sector often focus on defensive measures such as implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to protect against phishing. Continuous monitoring and robust incident response plans are also essential components of a modern cybersecurity posture to address the evolving tactics of RaaS-based threat actors.